PLUCO
Contact
PLUCO / Your data at PLUCO

Privacy policy

How we handle your data when you visit this website, contact us, use our forms or subscribe to our newsletter.

Last updated: 29 October 2026

1. Controller

PLU CO Immobilienvermittlungs GmbH
Weißdornweg 5
89195 Staig
Managing directors: Silvio Stöltzel and Holger Säger
Commercial register: Ulm Local Court, HRB 734954
Telephone: +49 731 3885288
Email: hallo@pluco.de

For all privacy questions and to exercise your rights, contact us at hallo@pluco.de.

2. Overview

We process personal data on this website in the following cases:

3. Hosting and website access

The website and its database are operated by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, as our processor. On each visit, Cloudflare processes technical connection data: IP address, date and time, requested address, data volume transferred, browser and operating system. These data are necessary to deliver the pages and protect the website from attacks.

We retain technical logs of our web service for no more than seven days. The legal basis is our legitimate interest in secure and stable operation (Article 6(1)(f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework. The processing agreement also includes the European Commission’s standard contractual clauses.

The connection to this website is encrypted using TLS. You can recognise this from “https://” in your browser’s address bar.

4. Cookies and consent

Without your consent, we only use storage strictly necessary to operate the website (section 25(2), no. 2 TDDDG):

  • The “pluco_consent” cookie stores your choice in the consent window, a random identifier and the time. It expires after twelve months, after which we ask again.
  • Local storage “pluco-theme” stores the light or dark appearance when you choose it. The entry remains until deleted in your browser.

We only use all other services with your consent (section 25(1) TDDDG, Article 6(1)(a) GDPR):

To demonstrate consent, we store, for each decision, the random identifier from the cookie, selected categories, version of the consent texts and time. We do not store your name, email address or IP address for this purpose. The legal basis is our duty to demonstrate consent (Article 6(1)(c) in conjunction with Article 7(1) GDPR). We delete these records after three years.

You may change or withdraw your consent at any time with effect for the future. Use “Cookie settings” in the footer of any page. Following withdrawal, we delete the statistics cookies in your browser. We also remove the withdrawn campaign data from local storage and from enquiries associated with this consent identifier.

These cookie settings control optional services on the public website. Google Maps within the authenticated platform loads automatically, independently of these settings. Details about this integration and withdrawal are provided under Google Maps.

5. Contact by email or telephone

When you email or call us, we process your contact details and the information in your enquiry to respond to it. The legal basis is taking steps prior to, or performing, a contract (Article 6(1)(b) GDPR), or otherwise our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR). Emails to addresses under pluco.de are processed by STRATO GmbH, Berlin, as our processor.

6. Contact form

Property investors, distribution partners, banks and financing partners, as well as builders and property developers, can contact us using the form on our contact page. We process:

  • Your role, first name, last name and email address.
  • Your company; this field is mandatory for partners.
  • Optionally, your telephone number and message.
  • Optionally, information about your investment goals, planned purchase volume and timeframe, or about your investor clients, regions and project interests.
  • The time of your enquiry and its processing status.

We use these details to respond to your enquiry and prepare a potential partnership. The legal basis is taking steps prior to a contract (Article 6(1)(b) GDPR), or, for enquiries on behalf of a company, our legitimate interest in processing them (Article 6(1)(f) GDPR). Your enquiry is stored in our database at Cloudflare and is accessible only to our team. The form does not send automatic emails.

We delete your enquiry once it has been fully processed, no later than two years after the last contact. If it results in a contract, statutory retention periods of up to ten years apply (section 257 HGB, section 147 AO).

To prevent abuse, we limit the number of requests per connection. For this purpose, we store an irreversible hash of your IP address for no more than 24 hours (Article 6(1)(f) GDPR). This limit also applies to access requests, the newsletter and the consent window.

7. Access request for the PLUCO platform

The access request introduces you to the PLUCO platform. We process your details to confirm your email address, understand your interest, personally review the request and communicate with you about potential access.

Depending on your role, the form collects:

  • Name, email address and full postal address; optionally, telephone number and existing contact person.
  • Your role, connection to PLUCO and, where applicable, your company.
  • For investors: property investment experience, planned investment budget and number of properties in the portfolio; optionally, its estimated value.
  • For partners: organisation type and intended use; optionally, the investor groups supported.
  • Voluntary details of preferred locations, property types, time horizon and your enquiry.

Mandatory fields are marked in the form. Without these details, the access request cannot be submitted using the form; you can still contact us directly. While you complete the form, your entries remain only in the open browser window and are not stored permanently in your browser.

We also store receipt and processing times, email confirmation status, processing status and internal review notes and decisions. Being added to the waiting list is not a promise of access. Our team decides on admission; decisions are not made solely by automated means.

The legal basis is taking steps prior to a contract (Article 6(1)(b) GDPR), or, for company contacts, our legitimate interest in processing requests (Article 6(1)(f) GDPR). Acknowledging that you have read this notice does not constitute consent to a newsletter. You can withdraw your access request at any time via hallo@pluco.de . We will then delete the request unless legal obligations prevent this.

8. Newsletter

Our newsletter covers market observations, selected projects and invitations. To register, we process your email address, registration time and the form through which you registered. The legal basis is your consent (Article 6(1)(a) GDPR).

Before sending the first newsletter, we ask you by email to confirm your registration (double opt-in). You will not receive a newsletter without confirmation. We do not track whether you open the newsletter or click its links.

You can unsubscribe at any time using the link in each issue or by emailing hallo@pluco.de. After you unsubscribe, we retain your email address and the times of consent and unsubscription for up to three years to demonstrate previous consent (Article 6(1)(c) and (f) GDPR).

We use Resend to send platform emails and newsletters. Recipient addresses, message content and technical delivery information are transmitted to Resend. Resend privacy information

9. Statistics with Google Analytics

With your consent, we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us understand how pages are used so we can improve content and usability. Statistics tags are loaded through Google Tag Manager from the same provider. Tag Manager also only loads after your consent to statistics.

This processes pages visited, page language, time spent, scroll depth, referring page, device type, browser, screen size and approximate region of origin. We also record interactions: starting and submitting a form with the selected role, form steps and technical errors without input contents, clicks on contact methods and buttons, selected criteria and topics, and started videos. We do not send your form entries, names, contact details or investment budget to Google Analytics. Google Analytics 4 does not store IP addresses. The “_ga” and “_ga_*” cookies store a random identifier for 13 months. Personalised ads and Google signals are disabled. Event data are deleted after two months.

Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (section 25(1) TDDDG, Article 6(1)(a) GDPR). Without consent, this website does not load Google Analytics. You can withdraw consent at any time under “Cookie settings”. Further information: Google privacy policy .

Campaigns and enquiry attribution

With your consent to statistics, we store standardised campaign information from a link, the landing page, hostname of the referring page and time in local storage for up to 90 days. For a contact enquiry, platform access request or newsletter registration, we may link these details, the random Analytics identifier and proof of consent with the enquiry. This helps distinguish the paths taken by property investors and distribution partners and evaluate our campaigns. Enquiries work without this consent too.

In our own contact database, enquiries with the same email address are assigned to one contact. Submissions receive a random confirmation identifier. Internally, we may link processing steps and later transactions to this contact. This supports the business relationship and, using permitted campaign information, helps us assess which paths lead to enquiries and clients. Contact details and financial information are not transferred to Google Analytics.

Only with additional marketing consent do we store advertising click identifiers such as GCLID, GBRAID, WBRAID, MSCLKID or FBCLID in your browser for up to 90 days. Google Ads loads through Google Tag Manager only with both statistics and marketing consent. It measures campaigns and attributes advertising interactions to accepted enquiries. For enhanced conversions, after an accepted investor or distribution-partner enquiry, your normalised email address and, where available, internationally formatted telephone number are hashed with SHA-256 and sent exclusively to Google Ads. These hashes are pseudonymous personal data that Google can match to signed-in Google accounts; they are not anonymous. We do not persist the matching values in browser storage. Marketing consent also covers attribution of later qualification and completed transactions to advertising interactions; messages, investment-budget details and property purchase prices are not transmitted. Google Ads cookies “_gcl_*” are stored for up to 90 days and deleted when consent is withdrawn. Personalised advertising and remarketing are disabled. Other advertising platforms receive no identifiers. Campaign details linked to an enquiry follow its retention period and are removed upon withdrawal through the same browser. You may also request deletion via hallo@pluco.de . We do not send names, email addresses, telephone numbers or message text as Analytics events. URL query strings and fragments are removed before transfer.

10. YouTube videos

We publish videos on our YouTube channel and display them on this website. We use YouTube, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in privacy-enhanced mode. Our server loads the video list and preview images without transferring data about you. Your browser does not connect to YouTube until you load a video. A video only loads when you choose “Load video” or allow “External media” in the cookie settings.

Once loaded, YouTube receives your IP address, the page accessed and information about your browser and device. During playback, YouTube may use cookies and local storage in your browser. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (section 25(1) TDDDG, Article 6(1)(a) GDPR).

10a. Google Maps in the platform

In property brochures and the project overview, including the admin area, we use Google Maps provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The project overview shows the project locations available to your account and their region; selecting a project zooms to its location. In a property brochure, the map shows that property's location. Maps load automatically when you open the relevant platform page.

Your browser connects directly to Google. Your IP address, technical browser and device information, project coordinates and map language are transmitted. The integration does not transmit PLUCO account details, internal project identifiers or form contents. In the project overview, Google also receives the platform domain, but no project paths or URL queries. The property brochure map sends no referrer. PLUCO does not request your device's location for these maps.

Google may use cookies and similar storage and, depending on your settings, associate usage with a signed-in Google account. Data may also be processed in the USA. Information about Google's processing, retention and privacy controls is available in the Google privacy policy.

The legal basis for the integration is your consent (Article 6(1)(a) GDPR; for storage or access on your device, section 25(1) TDDDG). This must cover Google Maps and the associated data transfer. You can contact hallo@pluco.de to withdraw your consent with effect for the future.

The knowledge library links to original contributions. Only a click takes you to the relevant site, where its own privacy notice applies. Before this, our website does not transfer data to the linked site.

12. Recipients and transfers to third countries

Your data are received only by the people and service providers who need them for the relevant purpose:

  • Our team, for enquiries, access requests and the newsletter.
  • Cloudflare, Inc., USA, for hosting and the database.
  • STRATO GmbH, Berlin, for email.
  • Google Ireland Limited and Google LLC, USA, for Google Analytics, Google Ads, YouTube and Google Maps, based on the consent described for each service.

Transfers to the USA rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR). We do not sell personal data.

13. Retention periods at a glance

  • Technical logs: no more than seven days.
  • Hashes for abuse prevention: no more than 24 hours.
  • Consent cookie: twelve months. Consent records: three years.
  • Statistics cookies: 13 months. Google Analytics event data: two months.
  • Browser campaign attribution: up to 90 days; linked details in enquiries until deletion or withdrawal.
  • Enquiries: until resolved, no more than two years after last contact; up to ten years where a contract results.
  • Access requests: until withdrawn or resolved, unless legal obligations prevent deletion.
  • Newsletter: until unsubscription; evidence retained for up to three years thereafter.

14. Your rights

You have the right to:

  • Access your data (Article 15 GDPR).
  • Rectification of inaccurate data (Article 16 GDPR).
  • Erasure (Article 17 GDPR).
  • Restriction of processing (Article 18 GDPR).
  • Data portability (Article 20 GDPR).
  • Withdraw consent with effect for the future (Article 7(3) GDPR).

Right to object under Article 21 GDPR: Where we process data based on our legitimate interest, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we demonstrate compelling legitimate grounds. You may object to processing for direct marketing at any time without giving reasons.

An email to the following address is sufficient for all requests: hallo@pluco.de. You may also complain to a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg .

15. Obligation to provide data and automated decisions

You are not obliged to provide us with data. However, without a form’s mandatory details we cannot process the relevant request. No automated decision-making, including profiling under Article 22 GDPR, takes place.

16. Changes to this policy

We update this privacy policy when our website, service providers or legal requirements change. The version published here applies. If services for which we request consent change, we will ask you again.